M54: harden operations and demo resilience

backend/tests/test_bookings.py

@@ -95,6 +95,16 @@ def test_booking_requirements_are_explicit_and_audited(ops_client):
     )
     assert checkout.status_code == 409
 
+    whitespace_only = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
+        json={"confirmation": "   "},
+    )
+    assert whitespace_only.status_code == 422
+    assert (
+        ops_client.get(f"/api/v1/bookings/{booking['public_ref']}").json()["requirements_complete"]
+        is False
+    )
+
     confirmed = ops_client.post(
         f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
         json={"confirmation": "Licence and rental conditions checked"},
@@ -106,6 +116,29 @@ def test_booking_requirements_are_explicit_and_audited(ops_client):
     assert any(item["entity_ref"] == booking["public_ref"] for item in audit.json())
 
 
+def test_booking_creation_cannot_preconfirm_requirements(ops_client):
+    window = {"starts_at": "2033-09-01T10:00:00Z", "ends_at": "2033-09-02T12:00:00Z"}
+    vehicle = ops_client.get("/api/v1/bookings/availability", params=window).json()[0]
+
+    created = ops_client.post(
+        "/api/v1/bookings",
+        json={
+            "customer_ref": "CUS-0001",
+            "vehicle_ref": vehicle["public_ref"],
+            "requirements_complete": True,
+            **window,
+        },
+    )
+
+    assert created.status_code == 201
+    assert created.json()["requirements_complete"] is False
+    audit = ops_client.get(
+        "/api/v1/audit",
+        params={"action": "booking_requirements_completed"},
+    )
+    assert all(item["entity_ref"] != created.json()["public_ref"] for item in audit.json())
+
+
 def test_customer_search_returns_canonical_customers(ops_client):
     response = ops_client.get("/api/v1/customers", params={"query": "CUS-"})
     assert response.status_code == 200
@@ -221,10 +254,14 @@ def test_checkout_records_inspection_and_activates_safe_booking(ops_client):
         json={
             "customer_ref": "CUS-0001",
             "vehicle_ref": vehicle["public_ref"],
-            "requirements_complete": True,
             **window,
         },
     ).json()
+    confirmed = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
+        json={"confirmation": "Licence and rental conditions checked"},
+    )
+    assert confirmed.status_code == 200
     response = ops_client.post(
         f"/api/v1/bookings/{booking['public_ref']}/checkout",
         json={
@@ -241,6 +278,95 @@ def test_checkout_records_inspection_and_activates_safe_booking(ops_client):
     updated_vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle['public_ref']}").json()
     assert updated_vehicle["operational_status"] == "rented"
     assert any(item["type"] == "checkout" for item in updated_vehicle["inspections"])
+    checkout_audit = ops_client.get(
+        "/api/v1/audit",
+        params={"action": "booking_checkout_recorded"},
+    ).json()
+    booking_event = next(
+        item for item in checkout_audit if item["entity_ref"] == booking["public_ref"]
+    )
+    vehicle_audit = ops_client.get(
+        "/api/v1/audit",
+        params={
+            "action": "vehicle_status_changed",
+            "correlation_id": booking_event["correlation_id"],
+        },
+    ).json()
+    assert len(vehicle_audit) == 1
+    assert vehicle_audit[0]["entity_ref"] == vehicle["public_ref"]
+    assert vehicle_audit[0]["before"]["operational_status"] == "available"
+    assert vehicle_audit[0]["after"]["operational_status"] == "rented"
+
+
+def test_checkout_odometer_regression_keeps_canonical_and_opens_bounded_quality_issue(
+    ops_client,
+):
+    window = {"starts_at": "2052-09-01T10:00:00Z", "ends_at": "2052-09-02T12:00:00Z"}
+    existing_issues = ops_client.get(
+        "/api/v1/data-quality/issues",
+        params={"status": "open", "rule_type": "odometer_regression"},
+    ).json()
+    unavailable_refs = {issue["entity_ref"] for issue in existing_issues}
+    available = ops_client.get("/api/v1/bookings/availability", params=window).json()
+    vehicle_option = next(
+        item
+        for item in available
+        if item["operational_status"] == "available" and item["public_ref"] not in unavailable_refs
+    )
+    vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle_option['public_ref']}").json()
+    assert vehicle["odometer_km"] > 0
+    booking = ops_client.post(
+        "/api/v1/bookings",
+        json={
+            "customer_ref": "CUS-0003",
+            "vehicle_ref": vehicle["public_ref"],
+            **window,
+        },
+    ).json()
+    ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
+        json={"confirmation": "Licence and rental conditions checked"},
+    )
+
+    checkout = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/checkout",
+        json={
+            "start_odometer_km": vehicle["odometer_km"] - 1,
+            "fuel_level_percent": 90,
+            "cleanliness_ok": True,
+            "damage_reported": False,
+            "technical_warning": False,
+        },
+    )
+
+    assert checkout.status_code == 200
+    assert checkout.json()["booking_status"] == "blocked"
+    updated_vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle['public_ref']}").json()
+    assert updated_vehicle["odometer_km"] == vehicle["odometer_km"]
+    issues = ops_client.get(
+        "/api/v1/data-quality/issues",
+        params={"status": "open", "rule_type": "odometer_regression"},
+    ).json()
+    issue = next(item for item in issues if item["entity_ref"] == vehicle["public_ref"])
+    assert issue["evidence"]["source_type"] == "checkout"
+    assert issue["evidence"]["correctable_booking_refs"] == []
+    detail = ops_client.get(f"/api/v1/data-quality/issues/{issue['public_ref']}").json()
+    assert any(snapshot["entity_type"] == "inspection" for snapshot in detail["related_snapshots"])
+    invalid_correction = ops_client.post(
+        f"/api/v1/data-quality/issues/{issue['public_ref']}/resolve-odometer-regression",
+        json={
+            "decision": "correct_reading",
+            "booking_ref": booking["public_ref"],
+            "corrected_odometer_km": vehicle["odometer_km"],
+        },
+    )
+    assert invalid_correction.status_code == 422
+    retained = ops_client.post(
+        f"/api/v1/data-quality/issues/{issue['public_ref']}/resolve-odometer-regression",
+        json={"decision": "retain_canonical"},
+    )
+    assert retained.status_code == 200
+    assert retained.json()["status"] == "resolved"
 
 
 def test_get_booking_detail(ops_client):